Live › vulnerability › GHSA-2rqm-h6hv-g79v
Go to dashboardodf-kit's odsToHtml() writes spreadsheet style values into an HTML style attribute without escaping, so a double quote in a crafted .ods file breaks out of the attribute. If the rendered HTML is inserted into a page, an attacker can inject tags and attributes and run script in that page's origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| odf-kit | npm | >= 0.9.8, < 0.14.2 | 0.14.2 |
Run npm ls odf-kit to find the installed version; affected versions are >= 0.9.8 and < 0.14.2.
Find code that calls odsToHtml( and check whether its output is inserted into a web page as HTML.
Check whether those .ods files can come from untrusted users.
0.14.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (odsToHtml()). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted .ods file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.
Two emission sites in src/ods/to-html/html-renderer.ts (before 0.14.0, src/ods-reader/html-renderer.ts) write document-controlled values into a style attribute without escaping:
buildInlineStyle() assembles a CSS string from the cell's formatting properties (fo:color, fo:font-size, fo:font-family, fo:background-color, fo:text-align, etc.) with no escaping, and renderCell emits it raw as the cell's style attribute.row.height (from style:row-height) is emitted raw into the row element's style attribute.The same defect in the ODT renderer (odtToHtml()) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).
Any consumer that renders odsToHtml() output as HTML gets XSS from a crafted .ods file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.
Fixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:
1424227: escape style attribute values in the ODS HTML rendereraa64c73: the shared escapeAttr helperUsers should upgrade to 0.14.2 or later.
Reported by @PethuKannan.
This page as .md · .json · in your agent: get_signal("GHSA-2rqm-h6hv-g79v")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.